224dadb71bcbe6332da2c1030b11b9aec03f0007d125f2d75e7303dcad015efc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe
Size

300KB
MD5

ed783966d9683a727ad7b3546f77b594
SHA1

a8da804fc3e1cd5d1234d5870d1421515d6cf1cc
SHA256

224dadb71bcbe6332da2c1030b11b9aec03f0007d125f2d75e7303dcad015efc
SHA512

fbe879dc9c65429059d9d4244b174154b55bda15adae4a6333395838993a1bba994d7cefca6f9fbcc63c46be45619b103c3bf72246f77e1f565b632fb2175f08
SSDEEP

6144:RH6xXV7njJG2WmLl8z8ExvjXRvu1iEJYBdgHrz0sDMlbl8weLBBBcvl7oS:RHcR0subjBvu0E8gUCMpCZHeloS

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1492	WinRAR.exe

Executes dropped EXE 1 IoCs

pid	Process
1492	WinRAR.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WinRAR\WinRAR.exe	ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	WinRAR.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2100	1492	WinRAR.exe	86
PID 1492 wrote to memory of 2100	1492	WinRAR.exe	86

C:\Users\Admin\AppData\Local\Temp\ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
PID:2248

C:\Program Files (x86)\WinRAR\WinRAR.exe
"C:\Program Files (x86)\WinRAR\WinRAR.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" %1
  2⤵
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WinRAR\WinRAR.exe

Filesize
300KB

MD5
ed783966d9683a727ad7b3546f77b594

SHA1
a8da804fc3e1cd5d1234d5870d1421515d6cf1cc

SHA256
224dadb71bcbe6332da2c1030b11b9aec03f0007d125f2d75e7303dcad015efc

SHA512
fbe879dc9c65429059d9d4244b174154b55bda15adae4a6333395838993a1bba994d7cefca6f9fbcc63c46be45619b103c3bf72246f77e1f565b632fb2175f08

Download Submit
memory/1492-7-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1492-8-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1492-10-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1492-12-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1492-13-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1492-16-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1492-19-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1492-22-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2248-0-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2248-1-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2248-9-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download